Full Report
Thousands of companies have been affected by the Mirage2FA campaign from 2024 to 2026. The commercial phishing-as-a-service toolkit targets Microsoft 365 accounts by abusing legitimate login flows and bypassing two-factor authentication. According to ANY.RUN research, 48% of targeted email addresses were potentially compromised. Most of the affected companies are US-based. Mirage2FA Campaign
Analysis Summary
# Incident Report: Mirage2FA Phishing-as-a-Service Campaign
## Executive Summary
The Mirage2FA campaign is a large-scale Phishing-as-a-Service (PhaaS) operation that compromised over 4,500 organizations between 2024 and 2026. By utilizing Adversary-in-the-Middle (AiTM) techniques, the campaign bypasses two-factor authentication (2FA) to hijack Microsoft 365 sessions. The attack has resulted in a 48% potential compromise rate among targeted users, leading to widespread unauthorized access to corporate environments and SSO-connected services.
## Incident Details
- **Discovery Date:** August 25, 2026 (Reported by ANY.RUN)
- **Incident Date:** Ongoing (Active 2024 – 2026)
- **Affected Organization:** 4,532 unique organizational email domains
- **Sector:** Technology, Manufacturing, and Education (Primary targets)
- **Geography:** Global; predominantly United States (63.7%), with significant activity in India, Singapore, UK, Canada, Saudi Arabia, and South Africa.
## Timeline of Events
### Initial Access
- **Date/Time:** 2024 – 2026
- **Vector:** Phishing / Adversary-in-the-Middle (AiTM)
- **Details:** Attackers deploy commercial toolkit flows that mirror legitimate Microsoft 365 login pages. Victims are lured via email to these proxy pages.
### Lateral Movement
- Once the session cookie is stolen, attackers impersonate the user to access internal Microsoft 365 services and connected Single Sign-On (SSO) applications, moving laterally across cloud-integrated platforms.
### Data Exfiltration/Impact
- Over 9,000 potential compromise events involving the theft of passwords and session cookies. Attackers gain full access to corporate emails, sensitive documents, and trusted business accounts.
### Detection & Response
- **Detection:** Identified through ANY.RUN research via sandbox analysis of suspicious WebSockets and redirect scripts.
- **Response:** Security teams are advised to revoke active sessions and tokens rather than relying solely on password resets.
## Attack Methodology
- **Initial Access:** Phishing-as-a-Service (PhaaS) using fake Microsoft 365 login flows.
- **Persistence:** Hijacking of long-lived session tokens/cookies.
- **Privilege Escalation:** Exploitation of SSO-connected apps to reach higher-value targets.
- **Defense Evasion:** Use of legitimate-looking login flows and encrypted WebSockets to bypass traditional email filters.
- **Credential Access:** AiTM proxying to capture both credentials and 2FA codes/session tokens in real-time.
- **Discovery:** Identifying corporate structures through accessed email and internal directories.
- **Lateral Movement:** Accessing secondary applications via hijacked SSO sessions.
- **Collection:** Gathering corporate intelligence from M365 services (Outlook, OneDrive, Teams).
- **Exfiltration:** Theft of session cookies and sensitive corporate data.
- **Impact:** Business Email Compromise (BEC), fraud, and identity-related risks.
## Impact Assessment
- **Financial:** High (associated with BEC and containment costs).
- **Data Breach:** Compromise of passwords, session cookies, and sensitive corporate communications for over 4,500 companies.
- **Operational:** Significant disruption due to the need for session revocation and identity auditing.
- **Reputational:** High risk for organizations in the Education and Tech sectors due to the potential leak of proprietary data.
## Indicators of Compromise
- **Network indicators:** Suspicious WebSocket activity originating from phishing domains; encoded data redirects (e.g., `example[.]com/login`).
- **File indicators:** Malicious loaders and HTML attachments used to initiate redirects.
- **Behavioral indicators:** Unusual login locations for M365 sessions; rapid access to multiple SSO-connected apps immediately following a login.
## Response Actions
- **Containment:** Revoke all active session tokens and cookies for suspected compromised accounts.
- **Eradication:** Implementation of phishing-resistant MFA (FIDO2/WebAuthn).
- **Recovery:** Restoration of account integrity and auditing of all actions taken during the hijacked session.
## Lessons Learned
- **MFA is not a Silver Bullet:** Standard 2FA (SMS/Push) is vulnerable to AiTM proxy attacks.
- **Session Management is Critical:** Password resets are insufficient if the attacker still holds a valid session cookie.
- **Visibility Gaps:** Traditional sandboxes may miss the complexity of WebSocket-based phishing without deep interactive analysis.
## Recommendations
- **Adopt Phishing-Resistant MFA:** Transition to hardware security keys or certificate-based authentication.
- **Enhance Monitoring:** Use security tools (like ANY.RUN) to analyze suspicious URLs for AiTM signatures (scripts, redirects).
- **Identity-Centric Response:** Treat session theft as an identity incident requiring token revocation and global sign-out.
- **User Training:** Educate employees on the specific appearance of AiTM login flows and the dangers of clicking links in unexpected emails.